WaratekVRT Sign in
Reset
More filters (2)
Columns
Published to 2012-12-31✕Vendor org.apache.tomcat✕
Overview 9 matches · 0 exploited · 0 CISA KEV · 4 public PoC · 2 EPSS ≥ 0.5
9matches 0exploited0.0% 0CISA KEV0.0% 4public PoC44.4% 2EPSS ≥ 0.522.2%
Protected by Waratek 9 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 7 77.8% Low 2 22.2% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 9 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 4 44.4% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 5 55.6%
split by peak 2 / year
Protected by Waratek: 9 Low: 2Medium: 7 blocked by ARMR today: 9 No public exploit: 5Working exploit published: 4
20021 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20031 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 20040 20050 20060 20071 Protected by Waratek1 Low1 blocked by ARMR today1 Working exploit published1 20082 Protected by Waratek2 Medium2 blocked by ARMR today2 Working exploit published2 20091 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20102 Protected by Waratek2 Medium2 blocked by ARMR today2 No public exploit2 20111 Protected by Waratek1 Low1 blocked by ARMR today1 No public exploit1
2002200320042005200620072008200920102011
9 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2010-3718 Low 2011-02-10 Protected by Waratek No public exploit Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.
CVE-2009-2902 Medium 2010-01-28 Protected by Waratek No public exploit Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.
CVE-2009-2693 Medium 2010-01-28 Protected by Waratek No public exploit Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry.
CVE-2008-5515 Medium 2009-06-16 Protected by Waratek No public exploit Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request.
CVE-2008-2938 Medium 2008-08-13 Protected by Waratek Working exploit published Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
CVE-2008-2370 Medium 2008-08-04 Protected by Waratek Working exploit published Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
CVE-2007-5461 Low 2007-10-15 Protected by Waratek Working exploit published Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.
CVE-2003-0042 Medium 2003-02-07 Protected by Waratek Working exploit published Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.
CVE-2000-1210 Medium 2002-03-22 Protected by Waratek No public exploit Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp.